/** @file
The operations for IKEv2 SA.
(C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php.
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include "Utility.h"
#include "IpSecDebug.h"
#include "IkeService.h"
#include "Ikev2.h"
/**
Generates the DH Key.
This generates the DH local public key and store it in the IKEv2 SA Session's GxBuffer.
@param[in] IkeSaSession Pointer to related IKE SA Session.
@retval EFI_SUCCESS The operation succeeded.
@retval Others The operation failed.
**/
EFI_STATUS
Ikev2GenerateSaDhPublicKey (
IN IKEV2_SA_SESSION *IkeSaSession
);
/**
Generates the IKEv2 SA key for the furthure IKEv2 exchange.
@param[in] IkeSaSession Pointer to IKEv2 SA Session.
@param[in] KePayload Pointer to Key payload used to generate the Key.
@retval EFI_UNSUPPORTED If the Algorithm Id is not supported.
@retval EFI_SUCCESS The operation succeeded.
**/
EFI_STATUS
Ikev2GenerateSaKeys (
IN IKEV2_SA_SESSION *IkeSaSession,
IN IKE_PAYLOAD *KePayload
);
/**
Generates the Keys for the furthure IPsec Protocol.
@param[in] ChildSaSession Pointer to IKE Child SA Session.
@param[in] KePayload Pointer to Key payload used to generate the Key.
@retval EFI_UNSUPPORTED If one or more Algorithm Id is unsupported.
@retval EFI_SUCCESS The operation succeeded.
**/
EFI_STATUS
Ikev2GenerateChildSaKeys (
IN IKEV2_CHILD_SA_SESSION *ChildSaSession,
IN IKE_PAYLOAD *KePayload
);
/**
Gernerates IKEv2 packet for IKE_SA_INIT exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION related to the exchange.
@param[in] Context Context Data passed by caller.
@retval EFI_SUCCESS The IKEv2 packet generation succeeded.
@retval Others The IKEv2 packet generation failed.
**/
IKE_PACKET *
Ikev2InitPskGenerator (
IN UINT8 *SaSession,
IN VOID *Context
)
{
IKE_PACKET *IkePacket;
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *KePayload;
IKE_PAYLOAD *NoncePayload;
IKE_PAYLOAD *NotifyPayload;
EFI_STATUS Status;
SaPayload = NULL;
KePayload = NULL;
NoncePayload = NULL;
NotifyPayload = NULL;
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
//
// 1. Allocate IKE packet
//
IkePacket = IkePacketAlloc ();
if (IkePacket == NULL) {
goto CheckError;
}
//
// 1.a Fill the IkePacket->Hdr
//
IkePacket->Header->ExchangeType = IKEV2_EXCHANGE_TYPE_INIT;
IkePacket->Header->InitiatorCookie = IkeSaSession->InitiatorCookie;
IkePacket->Header->ResponderCookie = IkeSaSession->ResponderCookie;
IkePacket->Header->Version = (UINT8) (2 << 4);
IkePacket->Header->MessageId = 0;
if (IkeSaSession->SessionCommon.IsInitiator) {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;
} else {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;
}
//
// If the NCookie is not NULL, this IKE_SA_INIT packet is resent by the NCookie
// and the NCookie payload should be the first payload in this packet.
//
if (IkeSaSession->NCookie != NULL) {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_NOTIFY;
NotifyPayload = Ikev2GenerateNotifyPayload (
IPSEC_PROTO_ISAKMP,
IKEV2_PAYLOAD_TYPE_SA,
0,
IKEV2_NOTIFICATION_COOKIE,
NULL,
IkeSaSession->NCookie,
IkeSaSession->NCookieSize
);
} else {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_SA;
}
//
// 2. Generate SA Payload according to the SaData & SaParams
//
SaPayload = Ikev2GenerateSaPayload (
IkeSaSession->SaData,
IKEV2_PAYLOAD_TYPE_KE,
IkeSessionTypeIkeSa
);
//
// 3. Generate DH public key.
// The DhPrivate Key has been generated in Ikev2InitPskParser, if the
// IkeSaSession is responder. If resending IKE_SA_INIT with Cookie Notify
// No need to recompute the Public key.
//
if ((IkeSaSession->SessionCommon.IsInitiator) && (IkeSaSession->NCookie == NULL)) {
Status = Ikev2GenerateSaDhPublicKey (IkeSaSession);
if (EFI_ERROR (Status)) {
goto CheckError;
}
}
//
// 4. Generate KE Payload according to SaParams->DhGroup
//
KePayload = Ikev2GenerateKePayload (
IkeSaSession,
IKEV2_PAYLOAD_TYPE_NONCE
);
//
// 5. Generate Nonce Payload
// If resending IKE_SA_INIT with Cookie Notify paylaod, no need to regenerate
// the Nonce Payload.
//
if ((IkeSaSession->SessionCommon.IsInitiator) && (IkeSaSession->NCookie == NULL)) {
IkeSaSession->NiBlkSize = IKE_NONCE_SIZE;
IkeSaSession->NiBlock = IkeGenerateNonce (IKE_NONCE_SIZE);
if (IkeSaSession->NiBlock == NULL) {
goto CheckError;
}
}
if (IkeSaSession->SessionCommon.IsInitiator) {
NoncePayload = Ikev2GenerateNoncePayload (
IkeSaSession->NiBlock,
IkeSaSession->NiBlkSize,
IKEV2_PAYLOAD_TYPE_NONE
);
} else {
//
// The Nonce Payload has been created in Ikev2PskParser if the IkeSaSession is
// responder.
//
NoncePayload = Ikev2GenerateNoncePayload (
IkeSaSession->NrBlock,
IkeSaSession->NrBlkSize,
IKEV2_PAYLOAD_TYPE_NONE
);
}
if (NotifyPayload != NULL) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, NotifyPayload);
}
if (SaPayload != NULL) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, SaPayload);
}
if (KePayload != NULL) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, KePayload);
}
if (NoncePayload != NULL) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, NoncePayload);
}
return IkePacket;
CheckError:
if (IkePacket != NULL) {
IkePacketFree (IkePacket);
}
if (SaPayload != NULL) {
IkePayloadFree (SaPayload);
}
return NULL;
}
/**
Parses the IKEv2 packet for IKE_SA_INIT exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION related to the exchange.
@param[in] IkePacket The received IKE packet to be parsed.
@retval EFI_SUCCESS The IKEv2 packet is acceptable and the relative data is
saved for furthure communication.
@retval EFI_INVALID_PARAMETER The IKEv2 packet is malformed or the SA proposal is unacceptable.
**/
EFI_STATUS
Ikev2InitPskParser (
IN UINT8 *SaSession,
IN IKE_PACKET *IkePacket
)
{
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *KeyPayload;
IKE_PAYLOAD *IkePayload;
IKE_PAYLOAD *NoncePayload;
IKE_PAYLOAD *NotifyPayload;
UINT8 *NonceBuffer;
UINTN NonceSize;
LIST_ENTRY *Entry;
EFI_STATUS Status;
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
KeyPayload = NULL;
SaPayload = NULL;
NoncePayload = NULL;
IkePayload = NULL;
NotifyPayload = NULL;
//
// Iterate payloads to find the SaPayload and KeyPayload.
//
NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
IkePayload = IKE_PAYLOAD_BY_PACKET (Entry);
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_SA) {
SaPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_KE) {
KeyPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NONCE) {
NoncePayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) {
NotifyPayload = IkePayload;
}
}
//
// According to RFC 4306 - 2.6. If the responder responds with the COOKIE Notify
// payload with the cookie data, initiator MUST retry the IKE_SA_INIT with a
// Notify payload of type COOKIE containing the responder suppplied cookie data
// as first payload and all other payloads unchanged.
//
if (IkeSaSession->SessionCommon.IsInitiator) {
if (NotifyPayload != NULL && !EFI_ERROR(Ikev2ParserNotifyCookiePayload (NotifyPayload, IkeSaSession))) {
return EFI_SUCCESS;
}
}
if ((KeyPayload == NULL) || (SaPayload == NULL) || (NoncePayload == NULL)) {
return EFI_INVALID_PARAMETER;
}
//
// Store NoncePayload for SKEYID computing.
//
NonceSize = NoncePayload->PayloadSize - sizeof (IKEV2_COMMON_PAYLOAD_HEADER);
NonceBuffer = (UINT8 *) AllocatePool (NonceSize);
if (NonceBuffer == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto CheckError;
}
CopyMem (
NonceBuffer,
NoncePayload->PayloadBuf + sizeof (IKEV2_COMMON_PAYLOAD_HEADER),
NonceSize
);
//
// Check if IkePacket Header matches the state
//
if (IkeSaSession->SessionCommon.IsInitiator) {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_RESPOND
//
if (IkePacket->Header->Flags != IKE_HEADER_FLAGS_RESPOND) {
Status = EFI_INVALID_PARAMETER;
goto CheckError;
}
//
// 2. Parse the SA Payload and Key Payload to find out the cryptographic
// suite and fill in the Sa paramse into CommonSession->SaParams
//
if (!Ikev2SaParseSaPayload (IkeSaSession, SaPayload, IkePacket->Header->Flags)) {
Status = EFI_INVALID_PARAMETER;
goto CheckError;
}
//
// 3. If Initiator, the NoncePayload is Nr_b.
//
IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateAuth);
IkeSaSession->NrBlock = NonceBuffer;
IkeSaSession->NrBlkSize = NonceSize;
IkeSaSession->SessionCommon.State = IkeStateAuth;
IkeSaSession->ResponderCookie = IkePacket->Header->ResponderCookie;
//
// 4. Change the state of IkeSaSession
//
IkeSaSession->SessionCommon.State = IkeStateAuth;
} else {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_INIT
//
if (IkePacket->Header->Flags != IKE_HEADER_FLAGS_INIT) {
Status = EFI_INVALID_PARAMETER;
goto CheckError;
}
//
// 2. Parse the SA payload and find out the perfered one
// and fill in the SA parameters into CommonSession->SaParams and SaData into
// IkeSaSession for the responder SA payload generation.
//
if (!Ikev2SaParseSaPayload (IkeSaSession, SaPayload, IkePacket->Header->Flags)) {
Status = EFI_INVALID_PARAMETER;
goto CheckError;
}
//
// 3. Generat Dh Y parivate Key
//
Status = Ikev2GenerateSaDhPublicKey (IkeSaSession);
if (EFI_ERROR (Status)) {
goto CheckError;
}
//
// 4. If Responder, the NoncePayload is Ni_b and go to generate Nr_b.
//
IkeSaSession->NiBlock = NonceBuffer;
IkeSaSession->NiBlkSize = NonceSize;
//
// 5. Generate Nr_b
//
IkeSaSession->NrBlock = IkeGenerateNonce (IKE_NONCE_SIZE);
ASSERT (IkeSaSession->NrBlock != NULL);
IkeSaSession->NrBlkSize = IKE_NONCE_SIZE;
//
// 6. Save the Cookies
//
IkeSaSession->InitiatorCookie = IkePacket->Header->InitiatorCookie;
IkeSaSession->ResponderCookie = IkeGenerateCookie ();
}
if (IkeSaSession->SessionCommon.PreferDhGroup != ((IKEV2_KEY_EXCHANGE *)KeyPayload->PayloadBuf)->DhGroup) {
Status = EFI_INVALID_PARAMETER;
goto CheckError;
}
//
// Call Ikev2GenerateSaKeys to create SKEYID, SKEYID_d, SKEYID_a, SKEYID_e.
//
Status = Ikev2GenerateSaKeys (IkeSaSession, KeyPayload);
if (EFI_ERROR(Status)) {
goto CheckError;
}
return EFI_SUCCESS;
CheckError:
if (NonceBuffer != NULL) {
FreePool (NonceBuffer);
}
return Status;
}
/**
Generates the IKEv2 packet for IKE_AUTH exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION.
@param[in] Context Context data passed by caller.
@retval Pointer to IKE Packet to be sent out.
**/
IKE_PACKET *
Ikev2AuthPskGenerator (
IN UINT8 *SaSession,
IN VOID *Context
)
{
IKE_PACKET *IkePacket;
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *IdPayload;
IKE_PAYLOAD *AuthPayload;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *TsiPayload;
IKE_PAYLOAD *TsrPayload;
IKE_PAYLOAD *NotifyPayload;
IKE_PAYLOAD *CpPayload;
IKEV2_CHILD_SA_SESSION *ChildSaSession;
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));
IkePacket = NULL;
IdPayload = NULL;
AuthPayload = NULL;
SaPayload = NULL;
TsiPayload = NULL;
TsrPayload = NULL;
NotifyPayload = NULL;
CpPayload = NULL;
NotifyPayload = NULL;
//
// 1. Allocate IKE Packet
//
IkePacket= IkePacketAlloc ();
if (IkePacket == NULL) {
return NULL;
}
//
// 1.a Fill the IkePacket Header.
//
IkePacket->Header->ExchangeType = IKEV2_EXCHANGE_TYPE_AUTH;
IkePacket->Header->InitiatorCookie = IkeSaSession->InitiatorCookie;
IkePacket->Header->ResponderCookie = IkeSaSession->ResponderCookie;
IkePacket->Header->Version = (UINT8)(2 << 4);
if (ChildSaSession->SessionCommon.IsInitiator) {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_ID_INIT;
} else {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_ID_RSP;
}
//
// According to RFC4306_2.2, For the IKE_SA_INIT message the MessageID should
// be always number 0 and 1;
//
IkePacket->Header->MessageId = 1;
if (IkeSaSession->SessionCommon.IsInitiator) {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;
} else {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;
}
//
// 2. Generate ID Payload according to IP version and address.
//
IdPayload = Ikev2GenerateIdPayload (
&IkeSaSession->SessionCommon,
IKEV2_PAYLOAD_TYPE_AUTH
);
if (IdPayload == NULL) {
goto CheckError;
}
//
// 3. Generate Auth Payload
// If it is tunnel mode, should create the configuration payload after the
// Auth payload.
//
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
AuthPayload = Ikev2PskGenerateAuthPayload (
ChildSaSession->IkeSaSession,
IdPayload,
IKEV2_PAYLOAD_TYPE_SA,
FALSE
);
} else {
AuthPayload = Ikev2PskGenerateAuthPayload (
ChildSaSession->IkeSaSession,
IdPayload,
IKEV2_PAYLOAD_TYPE_CP,
FALSE
);
if (IkeSaSession->SessionCommon.UdpService->IpVersion == IP_VERSION_4) {
CpPayload = Ikev2GenerateCpPayload (
ChildSaSession->IkeSaSession,
IKEV2_PAYLOAD_TYPE_SA,
IKEV2_CFG_ATTR_INTERNAL_IP4_ADDRESS
);
} else {
CpPayload = Ikev2GenerateCpPayload (
ChildSaSession->IkeSaSession,
IKEV2_PAYLOAD_TYPE_SA,
IKEV2_CFG_ATTR_INTERNAL_IP6_ADDRESS
);
}
if (CpPayload == NULL) {
goto CheckError;
}
}
if (AuthPayload == NULL) {
goto CheckError;
}
//
// 4. Generate SA Payload according to the SA Data in ChildSaSession
//
SaPayload = Ikev2GenerateSaPayload (
ChildSaSession->SaData,
IKEV2_PAYLOAD_TYPE_TS_INIT,
IkeSessionTypeChildSa
);
if (SaPayload == NULL) {
goto CheckError;
}
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
//
// Generate Tsi and Tsr.
//
TsiPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_TS_RSP,
FALSE
);
TsrPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_NOTIFY,
FALSE
);
//
// Generate Notify Payload. If transport mode, there should have Notify
// payload with TRANSPORT_MODE notification.
//
NotifyPayload = Ikev2GenerateNotifyPayload (
0,
IKEV2_PAYLOAD_TYPE_NONE,
0,
IKEV2_NOTIFICATION_USE_TRANSPORT_MODE,
NULL,
NULL,
0
);
if (NotifyPayload == NULL) {
goto CheckError;
}
} else {
//
// Generate Tsr for Tunnel mode.
//
TsiPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_TS_RSP,
TRUE
);
TsrPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_NONE,
FALSE
);
}
if (TsiPayload == NULL || TsrPayload == NULL) {
goto CheckError;
}
IKE_PACKET_APPEND_PAYLOAD (IkePacket, IdPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, AuthPayload);
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTunnel) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, CpPayload);
}
IKE_PACKET_APPEND_PAYLOAD (IkePacket, SaPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, TsiPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, TsrPayload);
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, NotifyPayload);
}
return IkePacket;
CheckError:
if (IkePacket != NULL) {
IkePacketFree (IkePacket);
}
if (IdPayload != NULL) {
IkePayloadFree (IdPayload);
}
if (AuthPayload != NULL) {
IkePayloadFree (AuthPayload);
}
if (CpPayload != NULL) {
IkePayloadFree (CpPayload);
}
if (SaPayload != NULL) {
IkePayloadFree (SaPayload);
}
if (TsiPayload != NULL) {
IkePayloadFree (TsiPayload);
}
if (TsrPayload != NULL) {
IkePayloadFree (TsrPayload);
}
if (NotifyPayload != NULL) {
IkePayloadFree (NotifyPayload);
}
return NULL;
}
/**
Parses IKE_AUTH packet.
@param[in] SaSession Pointer to the IKE_SA_SESSION related to this packet.
@param[in] IkePacket Pointer to the IKE_AUTH packet to be parsered.
@retval EFI_INVALID_PARAMETER The IKE packet is malformed or the SA
proposal is unacceptable.
@retval EFI_SUCCESS The IKE packet is acceptable and the
relative data is saved for furthure communication.
**/
EFI_STATUS
Ikev2AuthPskParser (
IN UINT8 *SaSession,
IN IKE_PACKET *IkePacket
)
{
IKEV2_CHILD_SA_SESSION *ChildSaSession;
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *IkePayload;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *IdiPayload;
IKE_PAYLOAD *IdrPayload;
IKE_PAYLOAD *AuthPayload;
IKE_PAYLOAD *TsiPayload;
IKE_PAYLOAD *TsrPayload;
IKE_PAYLOAD *VerifiedAuthPayload;
LIST_ENTRY *Entry;
EFI_STATUS Status;
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));
SaPayload = NULL;
IdiPayload = NULL;
IdrPayload = NULL;
AuthPayload = NULL;
TsiPayload = NULL;
TsrPayload = NULL;
//
// Iterate payloads to find the SaPayload/ID/AUTH/TS Payload.
//
NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
IkePayload = IKE_PAYLOAD_BY_PACKET (Entry);
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_ID_INIT) {
IdiPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_ID_RSP) {
IdrPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_SA) {
SaPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_AUTH) {
AuthPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_INIT) {
TsiPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_RSP) {
TsrPayload = IkePayload;
}
}
if ((SaPayload == NULL) || (AuthPayload == NULL) || (TsiPayload == NULL) || (TsrPayload == NULL)) {
return EFI_INVALID_PARAMETER;
}
if ((IdiPayload == NULL) && (IdrPayload == NULL)) {
return EFI_INVALID_PARAMETER;
}
//
// Check IkePacket Header is match the state
//
if (IkeSaSession->SessionCommon.IsInitiator) {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_RESPOND
//
if ((IkePacket->Header->Flags != IKE_HEADER_FLAGS_RESPOND) ||
(IkePacket->Header->ExchangeType != IKEV2_EXCHANGE_TYPE_AUTH)
) {
return EFI_INVALID_PARAMETER;
}
} else {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_INIT
//
if ((IkePacket->Header->Flags != IKE_HEADER_FLAGS_INIT) ||
(IkePacket->Header->ExchangeType != IKEV2_EXCHANGE_TYPE_AUTH)
) {
return EFI_INVALID_PARAMETER;
}
//
// 2. Parse the SA payload and Key Payload and find out the perferable one
// and fill in the Sa paramse into CommonSession->SaParams and SaData into
// IkeSaSession for the responder SA payload generation.
//
}
//
// Verify the Auth Payload.
//
VerifiedAuthPayload = Ikev2PskGenerateAuthPayload (
IkeSaSession,
IkeSaSession->SessionCommon.IsInitiator ? IdrPayload : IdiPayload,
IKEV2_PAYLOAD_TYPE_SA,
TRUE
);
if ((VerifiedAuthPayload != NULL) &&
(0 != CompareMem (
VerifiedAuthPayload->PayloadBuf + sizeof (IKEV2_COMMON_PAYLOAD_HEADER),
AuthPayload->PayloadBuf + sizeof (IKEV2_COMMON_PAYLOAD_HEADER),
VerifiedAuthPayload->PayloadSize - sizeof (IKEV2_COMMON_PAYLOAD_HEADER)
))) {
return EFI_INVALID_PARAMETER;
};
//
// 3. Parse the SA Payload to find out the cryptographic suite
// and fill in the Sa paramse into CommonSession->SaParams. If no acceptable
// porposal found, return EFI_INVALID_PARAMETER.
//
if (!Ikev2ChildSaParseSaPayload (ChildSaSession, SaPayload, IkePacket->Header->Flags)) {
return EFI_INVALID_PARAMETER;
}
//
// 4. Parse TSi, TSr payloads.
//
if ((((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId !=
((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId) &&
(((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId != 0) &&
(((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId != 0)
) {
return EFI_INVALID_PARAMETER;
}
if (!IkeSaSession->SessionCommon.IsInitiator) {
//
//TODO:check the Port range. Only support any port and one certain port here.
//
ChildSaSession->ProtoId = ((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId;
ChildSaSession->LocalPort = ((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort;
ChildSaSession->RemotePort = ((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort;
//
// Association a SPD with this SA.
//
Status = Ikev2ChildSaAssociateSpdEntry (ChildSaSession);
if (EFI_ERROR (Status)) {
return EFI_INVALID_PARAMETER;
}
//
// Associate the IkeSaSession's SPD to the first ChildSaSession's SPD.
//
if (ChildSaSession->IkeSaSession->Spd == NULL) {
ChildSaSession->IkeSaSession->Spd = ChildSaSession->Spd;
Status = Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);
if (EFI_ERROR (Status)) {
return Status;
}
}
} else {
//
//TODO:check the Port range.
//
if ((((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != 0) &&
(((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != ChildSaSession->RemotePort)
) {
return EFI_INVALID_PARAMETER;
}
if ((((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != 0) &&
(((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != ChildSaSession->LocalPort)
) {
return EFI_INVALID_PARAMETER;
}
//
// For the tunnel mode, it should add the vitual IP address into the SA's SPD Selector.
//
if (ChildSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTunnel) {
if (!ChildSaSession->IkeSaSession->SessionCommon.IsInitiator) {
//
// If it is tunnel mode, the UEFI part must be the initiator.
//
return EFI_INVALID_PARAMETER;
}
//
// Get the Virtual IP address from the Tsi traffic selector.
// TODO: check the CFG reply payload
//
CopyMem (
&ChildSaSession->SpdSelector->LocalAddress[0].Address,
TsiPayload->PayloadBuf + sizeof (IKEV2_TS) + sizeof (TRAFFIC_SELECTOR),
(ChildSaSession->SessionCommon.UdpService->IpVersion == IP_VERSION_4) ?
sizeof (EFI_IPv4_ADDRESS) : sizeof (EFI_IPv6_ADDRESS)
);
}
}
//
// 5. Generate keymats for IPsec protocol.
//
Status = Ikev2GenerateChildSaKeys (ChildSaSession, NULL);
if (EFI_ERROR (Status)) {
return Status;
}
if (IkeSaSession->SessionCommon.IsInitiator) {
//
// 6. Change the state of IkeSaSession
//
IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateIkeSaEstablished);
IkeSaSession->SessionCommon.State = IkeStateIkeSaEstablished;
}
return EFI_SUCCESS;
}
/**
Gernerates IKEv2 packet for IKE_SA_INIT exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION related to the exchange.
@param[in] Context Context Data passed by caller.
@retval EFI_SUCCESS The IKE packet generation succeeded.
@retval Others The IKE packet generation failed.
**/
IKE_PACKET*
Ikev2InitCertGenerator (
IN UINT8 *SaSession,
IN VOID *Context
)
{
IKE_PACKET *IkePacket;
IKE_PAYLOAD *CertReqPayload;
LIST_ENTRY *Node;
IKE_PAYLOAD *NoncePayload;
if (!FeaturePcdGet (PcdIpsecCertificateEnabled)) {
return NULL;
}
//
// The first two messages exchange is same between PSK and Cert.
//
IkePacket = Ikev2InitPskGenerator (SaSession, Context);
if ((IkePacket != NULL) && (!((IKEV2_SA_SESSION *)SaSession)->SessionCommon.IsInitiator)) {
//
// Add the Certification Request Payload
//
CertReqPayload = Ikev2GenerateCertificatePayload (
(IKEV2_SA_SESSION *)SaSession,
IKEV2_PAYLOAD_TYPE_NONE,
(UINT8*)PcdGetPtr(PcdIpsecUefiCaFile),
PcdGet32(PcdIpsecUefiCaFileSize),
IKEV2_CERT_ENCODEING_HASH_AND_URL_OF_X509_CERT,
TRUE
);
//
// Change Nonce Payload Next payload type.
//
IKE_PACKET_END_PAYLOAD (IkePacket, Node);
NoncePayload = IKE_PAYLOAD_BY_PACKET (Node);
((IKEV2_NONCE *)NoncePayload->PayloadBuf)->Header.NextPayload = IKEV2_PAYLOAD_TYPE_CERTREQ;
//
// Add Certification Request Payload
//
IKE_PACKET_APPEND_PAYLOAD (IkePacket, CertReqPayload);
}
return IkePacket;
}
/**
Parses the IKEv2 packet for IKE_SA_INIT exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION related to the exchange.
@param[in] IkePacket The received IKEv2 packet to be parsed.
@retval EFI_SUCCESS The IKEv2 packet is acceptable and the relative data is
saved for furthure communication.
@retval EFI_INVALID_PARAMETER The IKE packet is malformed or the SA proposal is unacceptable.
@retval EFI_UNSUPPORTED The certificate authentication is not supported.
**/
EFI_STATUS
Ikev2InitCertParser (
IN UINT8 *SaSession,
IN IKE_PACKET *IkePacket
)
{
if (!FeaturePcdGet (PcdIpsecCertificateEnabled)) {
return EFI_UNSUPPORTED;
}
//
// The first two messages exchange is same between PSK and Cert.
// Todo: Parse Certificate Request from responder Initial Exchange.
//
return Ikev2InitPskParser (SaSession, IkePacket);
}
/**
Generates the IKEv2 packet for IKE_AUTH exchange.
@param[in] SaSession Pointer to IKEV2_SA_SESSION.
@param[in] Context Context data passed by caller.
@retval Pointer to IKEv2 Packet to be sent out.
**/
IKE_PACKET *
Ikev2AuthCertGenerator (
IN UINT8 *SaSession,
IN VOID *Context
)
{
IKE_PACKET *IkePacket;
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *IdPayload;
IKE_PAYLOAD *AuthPayload;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *TsiPayload;
IKE_PAYLOAD *TsrPayload;
IKE_PAYLOAD *NotifyPayload;
IKE_PAYLOAD *CpPayload;
IKE_PAYLOAD *CertPayload;
IKE_PAYLOAD *CertReqPayload;
IKEV2_CHILD_SA_SESSION *ChildSaSession;
if (!FeaturePcdGet (PcdIpsecCertificateEnabled)) {
return NULL;
}
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));
IkePacket = NULL;
IdPayload = NULL;
AuthPayload = NULL;
CpPayload = NULL;
SaPayload = NULL;
TsiPayload = NULL;
TsrPayload = NULL;
NotifyPayload = NULL;
CertPayload = NULL;
CertReqPayload = NULL;
//
// 1. Allocate IKE Packet
//
IkePacket= IkePacketAlloc ();
if (IkePacket == NULL) {
return NULL;
}
//
// 1.a Fill the IkePacket Header.
//
IkePacket->Header->ExchangeType = IKEV2_EXCHANGE_TYPE_AUTH;
IkePacket->Header->InitiatorCookie = IkeSaSession->InitiatorCookie;
IkePacket->Header->ResponderCookie = IkeSaSession->ResponderCookie;
IkePacket->Header->Version = (UINT8)(2 << 4);
if (ChildSaSession->SessionCommon.IsInitiator) {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_ID_INIT;
} else {
IkePacket->Header->NextPayload = IKEV2_PAYLOAD_TYPE_ID_RSP;
}
//
// According to RFC4306_2.2, For the IKE_SA_INIT message the MessageID should
// be always number 0 and 1;
//
IkePacket->Header->MessageId = 1;
if (IkeSaSession->SessionCommon.IsInitiator) {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;
} else {
IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;
}
//
// 2. Generate ID Payload according to IP version and address.
//
IdPayload = Ikev2GenerateCertIdPayload (
&IkeSaSession->SessionCommon,
IKEV2_PAYLOAD_TYPE_CERT,
(UINT8 *)PcdGetPtr (PcdIpsecUefiCertificate),
PcdGet32 (PcdIpsecUefiCertificateSize)
);
if (IdPayload == NULL) {
goto CheckError;
}
//
// 3. Generate Certificate Payload
//
CertPayload = Ikev2GenerateCertificatePayload (
IkeSaSession,
(UINT8)(IkeSaSession->SessionCommon.IsInitiator ? IKEV2_PAYLOAD_TYPE_CERTREQ : IKEV2_PAYLOAD_TYPE_AUTH),
(UINT8 *)PcdGetPtr (PcdIpsecUefiCertificate),
PcdGet32 (PcdIpsecUefiCertificateSize),
IKEV2_CERT_ENCODEING_X509_CERT_SIGN,
FALSE
);
if (CertPayload == NULL) {
goto CheckError;
}
if (IkeSaSession->SessionCommon.IsInitiator) {
CertReqPayload = Ikev2GenerateCertificatePayload (
IkeSaSession,
IKEV2_PAYLOAD_TYPE_AUTH,
(UINT8 *)PcdGetPtr (PcdIpsecUefiCertificate),
PcdGet32 (PcdIpsecUefiCertificateSize),
IKEV2_CERT_ENCODEING_HASH_AND_URL_OF_X509_CERT,
TRUE
);
if (CertReqPayload == NULL) {
goto CheckError;
}
}
//
// 4. Generate Auth Payload
// If it is tunnel mode, should create the configuration payload after the
// Auth payload.
//
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
AuthPayload = Ikev2CertGenerateAuthPayload (
ChildSaSession->IkeSaSession,
IdPayload,
IKEV2_PAYLOAD_TYPE_SA,
FALSE,
(UINT8 *)PcdGetPtr (PcdIpsecUefiCertificateKey),
PcdGet32 (PcdIpsecUefiCertificateKeySize),
ChildSaSession->IkeSaSession->Pad->Data->AuthData,
ChildSaSession->IkeSaSession->Pad->Data->AuthDataSize
);
} else {
AuthPayload = Ikev2CertGenerateAuthPayload (
ChildSaSession->IkeSaSession,
IdPayload,
IKEV2_PAYLOAD_TYPE_CP,
FALSE,
(UINT8 *)PcdGetPtr (PcdIpsecUefiCertificateKey),
PcdGet32 (PcdIpsecUefiCertificateKeySize),
ChildSaSession->IkeSaSession->Pad->Data->AuthData,
ChildSaSession->IkeSaSession->Pad->Data->AuthDataSize
);
if (IkeSaSession->SessionCommon.UdpService->IpVersion == IP_VERSION_4) {
CpPayload = Ikev2GenerateCpPayload (
ChildSaSession->IkeSaSession,
IKEV2_PAYLOAD_TYPE_SA,
IKEV2_CFG_ATTR_INTERNAL_IP4_ADDRESS
);
} else {
CpPayload = Ikev2GenerateCpPayload (
ChildSaSession->IkeSaSession,
IKEV2_PAYLOAD_TYPE_SA,
IKEV2_CFG_ATTR_INTERNAL_IP6_ADDRESS
);
}
if (CpPayload == NULL) {
goto CheckError;
}
}
if (AuthPayload == NULL) {
goto CheckError;
}
//
// 5. Generate SA Payload according to the Sa Data in ChildSaSession
//
SaPayload = Ikev2GenerateSaPayload (
ChildSaSession->SaData,
IKEV2_PAYLOAD_TYPE_TS_INIT,
IkeSessionTypeChildSa
);
if (SaPayload == NULL) {
goto CheckError;
}
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
//
// Generate Tsi and Tsr.
//
TsiPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_TS_RSP,
FALSE
);
TsrPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_NOTIFY,
FALSE
);
//
// Generate Notify Payload. If transport mode, there should have Notify
// payload with TRANSPORT_MODE notification.
//
NotifyPayload = Ikev2GenerateNotifyPayload (
0,
IKEV2_PAYLOAD_TYPE_NONE,
0,
IKEV2_NOTIFICATION_USE_TRANSPORT_MODE,
NULL,
NULL,
0
);
if (NotifyPayload == NULL) {
goto CheckError;
}
} else {
//
// Generate Tsr for Tunnel mode.
//
TsiPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_TS_RSP,
TRUE
);
TsrPayload = Ikev2GenerateTsPayload (
ChildSaSession,
IKEV2_PAYLOAD_TYPE_NONE,
FALSE
);
}
if (TsiPayload == NULL || TsrPayload == NULL) {
goto CheckError;
}
IKE_PACKET_APPEND_PAYLOAD (IkePacket, IdPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, CertPayload);
if (IkeSaSession->SessionCommon.IsInitiator) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, CertReqPayload);
}
IKE_PACKET_APPEND_PAYLOAD (IkePacket, AuthPayload);
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTunnel) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, CpPayload);
}
IKE_PACKET_APPEND_PAYLOAD (IkePacket, SaPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, TsiPayload);
IKE_PACKET_APPEND_PAYLOAD (IkePacket, TsrPayload);
if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {
IKE_PACKET_APPEND_PAYLOAD (IkePacket, NotifyPayload);
}
return IkePacket;
CheckError:
if (IkePacket != NULL) {
IkePacketFree (IkePacket);
}
if (IdPayload != NULL) {
IkePayloadFree (IdPayload);
}
if (CertPayload != NULL) {
IkePayloadFree (CertPayload);
}
if (CertReqPayload != NULL) {
IkePayloadFree (CertReqPayload);
}
if (AuthPayload != NULL) {
IkePayloadFree (AuthPayload);
}
if (CpPayload != NULL) {
IkePayloadFree (CpPayload);
}
if (SaPayload != NULL) {
IkePayloadFree (SaPayload);
}
if (TsiPayload != NULL) {
IkePayloadFree (TsiPayload);
}
if (TsrPayload != NULL) {
IkePayloadFree (TsrPayload);
}
if (NotifyPayload != NULL) {
IkePayloadFree (NotifyPayload);
}
return NULL;
}
/**
Parses IKE_AUTH packet.
@param[in] SaSession Pointer to the IKE_SA_SESSION related to this packet.
@param[in] IkePacket Pointer to the IKE_AUTH packet to be parsered.
@retval EFI_INVALID_PARAMETER The IKEv2 packet is malformed or the SA
proposal is unacceptable.
@retval EFI_SUCCESS The IKE packet is acceptable and the
relative data is saved for furthure communication.
@retval EFI_UNSUPPORTED The certificate authentication is not supported.
**/
EFI_STATUS
Ikev2AuthCertParser (
IN UINT8 *SaSession,
IN IKE_PACKET *IkePacket
)
{
IKEV2_CHILD_SA_SESSION *ChildSaSession;
IKEV2_SA_SESSION *IkeSaSession;
IKE_PAYLOAD *IkePayload;
IKE_PAYLOAD *SaPayload;
IKE_PAYLOAD *IdiPayload;
IKE_PAYLOAD *IdrPayload;
IKE_PAYLOAD *AuthPayload;
IKE_PAYLOAD *TsiPayload;
IKE_PAYLOAD *TsrPayload;
IKE_PAYLOAD *CertPayload;
IKE_PAYLOAD *VerifiedAuthPayload;
LIST_ENTRY *Entry;
EFI_STATUS Status;
if (!FeaturePcdGet (PcdIpsecCertificateEnabled)) {
return EFI_UNSUPPORTED;
}
IkeSaSession = (IKEV2_SA_SESSION *) SaSession;
ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));
SaPayload = NULL;
IdiPayload = NULL;
IdrPayload = NULL;
AuthPayload = NULL;
TsiPayload = NULL;
TsrPayload = NULL;
CertPayload = NULL;
VerifiedAuthPayload = NULL;
Status = EFI_INVALID_PARAMETER;
//
// Iterate payloads to find the SaPayload/ID/AUTH/TS Payload.
//
NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
IkePayload = IKE_PAYLOAD_BY_PACKET (Entry);
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_ID_INIT) {
IdiPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_ID_RSP) {
IdrPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_SA) {
SaPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_AUTH) {
AuthPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_INIT) {
TsiPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_RSP) {
TsrPayload = IkePayload;
}
if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_CERT) {
CertPayload = IkePayload;
}
}
if ((SaPayload == NULL) || (AuthPayload == NULL) || (TsiPayload == NULL) ||
(TsrPayload == NULL) || (CertPayload == NULL)) {
goto Exit;
}
if ((IdiPayload == NULL) && (IdrPayload == NULL)) {
goto Exit;
}
//
// Check IkePacket Header is match the state
//
if (IkeSaSession->SessionCommon.IsInitiator) {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_RESPOND
//
if ((IkePacket->Header->Flags != IKE_HEADER_FLAGS_RESPOND) ||
(IkePacket->Header->ExchangeType != IKEV2_EXCHANGE_TYPE_AUTH)) {
goto Exit;
}
} else {
//
// 1. Check the IkePacket->Hdr == IKE_HEADER_FLAGS_INIT
//
if ((IkePacket->Header->Flags != IKE_HEADER_FLAGS_INIT) ||
(IkePacket->Header->ExchangeType != IKEV2_EXCHANGE_TYPE_AUTH)) {
goto Exit;
}
}
//
// Verify the Auth Payload.
//
VerifiedAuthPayload = Ikev2CertGenerateAuthPayload (
IkeSaSession,
IkeSaSession->SessionCommon.IsInitiator ? IdrPayload:IdiPayload,
IKEV2_PAYLOAD_TYPE_SA,
TRUE,
NULL,
0,
NULL,
0
);
if ((VerifiedAuthPayload != NULL) &&
(!IpSecCryptoIoVerifySignDataByCertificate (
CertPayload->PayloadBuf + sizeof (IKEV2_CERT),
CertPayload->PayloadSize - sizeof (IKEV2_CERT),
(UINT8 *)PcdGetPtr (PcdIpsecUefiCaFile),
PcdGet32 (PcdIpsecUefiCaFileSize),
VerifiedAuthPayload->PayloadBuf + sizeof (IKEV2_AUTH),
VerifiedAuthPayload->PayloadSize - sizeof (IKEV2_AUTH),
AuthPayload->PayloadBuf + sizeof (IKEV2_AUTH),
AuthPayload->PayloadSize - sizeof (IKEV2_AUTH)
))) {
goto Exit;
}
//
// 3. Parse the SA Payload to find out the cryptographic suite
// and fill in the SA paramse into CommonSession->SaParams. If no acceptable
// porposal found, return EFI_INVALID_PARAMETER.
//
if (!Ikev2ChildSaParseSaPayload (ChildSaSession, SaPayload, IkePacket->Header->Flags)) {
goto Exit;
}
//
// 4. Parse TSi, TSr payloads.
//
if ((((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId !=
((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId) &&
(((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId != 0) &&
(((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId != 0)
) {
goto Exit;
}
if (!IkeSaSession->SessionCommon.IsInitiator) {
//
//Todo:check the Port range. Only support any port and one certain port here.
//
ChildSaSession->ProtoId = ((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->IpProtocolId;
ChildSaSession->LocalPort = ((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort;
ChildSaSession->RemotePort = ((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort;
//
// Association a SPD with this SA.
//
if (EFI_ERROR (Ikev2ChildSaAssociateSpdEntry (ChildSaSession))) {
goto Exit;
}
//
// Associate the IkeSaSession's SPD to the first ChildSaSession's SPD.
//
if (ChildSaSession->IkeSaSession->Spd == NULL) {
ChildSaSession->IkeSaSession->Spd = ChildSaSession->Spd;
Status = Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);
if (EFI_ERROR (Status)) {
goto Exit;
}
}
} else {
//
// Todo:check the Port range.
//
if ((((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != 0) &&
(((TRAFFIC_SELECTOR *)(TsrPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != ChildSaSession->RemotePort)
) {
goto Exit;
}
if ((((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != 0) &&
(((TRAFFIC_SELECTOR *)(TsiPayload->PayloadBuf + sizeof (IKEV2_TS)))->StartPort != ChildSaSession->LocalPort)
) {
goto Exit;
}
//
// For the tunnel mode, it should add the vitual IP address into the SA's SPD Selector.
//
if (ChildSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTunnel) {
if (!ChildSaSession->IkeSaSession->SessionCommon.IsInitiator) {
//
// If it is tunnel mode, the UEFI part must be the initiator.
//
goto Exit;
}
//
// Get the Virtual IP address from the Tsi traffic selector.
// TODO: check the CFG reply payload
//
CopyMem (
&ChildSaSession->SpdSelector->LocalAddress[0].Address,
TsiPayload->PayloadBuf + sizeof (IKEV2_TS) + sizeof (TRAFFIC_SELECTOR),
(ChildSaSession->SessionCommon.UdpService->IpVersion == IP_VERSION_4) ?
sizeof (EFI_IPv4_ADDRESS) : sizeof (EFI_IPv6_ADDRESS)
);
}
}
//
// 5. Generat keymats for IPsec protocol.
//
Status = Ikev2GenerateChildSaKeys (ChildSaSession, NULL);
if (EFI_ERROR (Status)) {
goto Exit;
}
if (IkeSaSession->SessionCommon.IsInitiator) {
//
// 6. Change the state of IkeSaSession
//
IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateIkeSaEstablished);
IkeSaSession->SessionCommon.State = IkeStateIkeSaEstablished;
}
Status = EFI_SUCCESS;
Exit:
if (VerifiedAuthPayload != NULL) {
IkePayloadFree (VerifiedAuthPayload);
}
return Status;
}
/**
Generates the DH Public Key.
This generates the DH local public key and store it in the IKE SA Session's GxBuffer.
@param[in] IkeSaSession Pointer to related IKE SA Session.
@retval EFI_SUCCESS The operation succeeded.
@retval Others The operation failed.
**/
EFI_STATUS
Ikev2GenerateSaDhPublicKey (
IN IKEV2_SA_SESSION *IkeSaSession
)
{
EFI_STATUS Status;
IKEV2_SESSION_KEYS *IkeKeys;
IkeSaSession->IkeKeys = AllocateZeroPool (sizeof (IKEV2_SESSION_KEYS));
if (IkeSaSession->IkeKeys == NULL) {
return EFI_OUT_OF_RESOURCES;
}
IkeKeys = IkeSaSession->IkeKeys;
IkeKeys->DhBuffer = AllocateZeroPool (sizeof (IKEV2_DH_BUFFER));
if (IkeKeys->DhBuffer == NULL) {
FreePool (IkeSaSession->IkeKeys);
return EFI_OUT_OF_RESOURCES;
}
//
// Init DH with the certain DH Group Description.
//
IkeKeys->DhBuffer->GxSize = OakleyModpGroup[(UINT8)IkeSaSession->SessionCommon.PreferDhGroup].Size >> 3;
IkeKeys->DhBuffer->GxBuffer = AllocateZeroPool (IkeKeys->DhBuffer->GxSize);
if (IkeKeys->DhBuffer->GxBuffer == NULL) {
FreePool (IkeKeys->DhBuffer);
FreePool (IkeSaSession->IkeKeys);
return EFI_OUT_OF_RESOURCES;
}
//
// Get X PublicKey
//
Status = IpSecCryptoIoDhGetPublicKey (
&IkeKeys->DhBuffer->DhContext,
OakleyModpGroup[(UINT8)IkeSaSession->SessionCommon.PreferDhGroup].GroupGenerator,
OakleyModpGroup[(UINT8)IkeSaSession->SessionCommon.PreferDhGroup].Size,
OakleyModpGroup[(UINT8)IkeSaSession->SessionCommon.PreferDhGroup].Modulus,
IkeKeys->DhBuffer->GxBuffer,
&IkeKeys->DhBuffer->GxSize
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Error CPLKeyManGetKeyParam X public key error Status = %r\n", Status));
FreePool (IkeKeys->DhBuffer->GxBuffer);
FreePool (IkeKeys->DhBuffer);
FreePool (IkeSaSession->IkeKeys);
return Status;
}
IPSEC_DUMP_BUF ("DH Public Key (g^x) Dump", IkeKeys->DhBuffer->GxBuffer, IkeKeys->DhBuffer->GxSize);
return EFI_SUCCESS;
}
/**
Computes the DH Shared/Exchange Key.
Given peer's public key, this function computes the exchanged common key and
stores it in the IKEv2 SA Session's GxyBuffer.
@param[in] DhBuffer Pointer to buffer of peer's puliic key.
@param[in] KePayload Pointer to received key payload.
@retval EFI_SUCCESS The operation succeeded.
@retval Otherwise The operation failed.
**/
EFI_STATUS
Ikev2GenerateSaDhComputeKey (
IN IKEV2_DH_BUFFER *DhBuffer,
IN IKE_PAYLOAD *KePayload
)
{
EFI_STATUS Status;
IKEV2_KEY_EXCHANGE *Ke;
UINT8 *PubKey;
UINTN PubKeySize;
Ke = (IKEV2_KEY_EXCHANGE *) KePayload->PayloadBuf;
PubKey = (UINT8 *) (Ke + 1);
PubKeySize = KePayload->PayloadSize - sizeof (IKEV2_KEY_EXCHANGE);
DhBuffer->GxySize = DhBuffer->GxSize;
DhBuffer->GxyBuffer = AllocateZeroPool (DhBuffer->GxySize);
if (DhBuffer->GxyBuffer == NULL) {
return EFI_OUT_OF_RESOURCES;
}
//
// Get GxyBuf
//
Status = IpSecCryptoIoDhComputeKey (
DhBuffer->DhContext,
PubKey,
PubKeySize,
DhBuffer->GxyBuffer,
&DhBuffer->GxySize
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Error CPLKeyManGetKeyParam Y session key error Status = %r\n", Status));
FreePool (DhBuffer->GxyBuffer);
return Status;
}
//
// Create GxyBuf.
//
DhBuffer->GySize = PubKeySize;
DhBuffer->GyBuffer = AllocateZeroPool (DhBuffer->GySize);
if (DhBuffer->GyBuffer == NULL) {
FreePool (DhBuffer->GxyBuffer);
return Status;
}
CopyMem (DhBuffer->GyBuffer, PubKey, DhBuffer->GySize);
IPSEC_DUMP_BUF ("DH Public Key (g^y) Dump", DhBuffer->GyBuffer, DhBuffer->GySize);
IPSEC_DUMP_BUF ("DH Shared Key (g^xy) Dump", DhBuffer->GxyBuffer, DhBuffer->GxySize);
return EFI_SUCCESS;
}
/**
Generates the IKE SKEYSEED and seven other secrets. SK_d, SK_ai, SK_ar, SK_ei, SK_er,
SK_pi, SK_pr are keys for the furthure IKE exchange.
@param[in] IkeSaSession Pointer to IKE SA Session.
@param[in] KePayload Pointer to Key payload used to generate the Key.
@retval EFI_UNSUPPORTED If one or more Algorithm Id is not supported.
@retval EFI_OUT_OF_RESOURCES If there is no enough resource to be allocated to
meet the requirement.
@retval EFI_SUCCESS The operation succeeded.
**/
EFI_STATUS
Ikev2GenerateSaKeys (
IN IKEV2_SA_SESSION *IkeSaSession,
IN IKE_PAYLOAD *KePayload
)
{
EFI_STATUS Status;
IKEV2_SA_PARAMS *SaParams;
PRF_DATA_FRAGMENT Fragments[4];
UINT64 InitiatorCookieNet;
UINT64 ResponderCookieNet;
UINT8 *KeyBuffer;
UINTN KeyBufferSize;
UINTN AuthAlgKeyLen;
UINTN EncryptAlgKeyLen;
UINTN IntegrityAlgKeyLen;
UINTN PrfAlgKeyLen;
UINT8 *OutputKey;
UINTN OutputKeyLength;
UINT8 *Digest;
UINTN DigestSize;
Digest = NULL;
OutputKey = NULL;
KeyBuffer = NULL;
Status = EFI_SUCCESS;
//
// Generate Gxy
//
Status = Ikev2GenerateSaDhComputeKey (IkeSaSession->IkeKeys->DhBuffer, KePayload);
if (EFI_ERROR (Status)) {
goto Exit;
}
//
// Get the key length of Authenticaion, Encryption, PRF, and Integrity.
//
SaParams = IkeSaSession->SessionCommon.SaParams;
AuthAlgKeyLen = IpSecGetHmacDigestLength ((UINT8)SaParams->Prf);
EncryptAlgKeyLen = IpSecGetEncryptKeyLength ((UINT8)SaParams->EncAlgId);
IntegrityAlgKeyLen = IpSecGetHmacDigestLength ((UINT8)SaParams->IntegAlgId);
PrfAlgKeyLen = IpSecGetHmacDigestLength ((UINT8)SaParams->Prf);
//
// If one or more algorithm is not support, return EFI_UNSUPPORTED.
//
if (AuthAlgKeyLen == 0 ||
EncryptAlgKeyLen == 0 ||
IntegrityAlgKeyLen == 0 ||
PrfAlgKeyLen == 0
) {
Status = EFI_UNSUPPORTED;
goto Exit;
}
//
// Compute SKEYSEED = prf(Ni | Nr, g^ir)
//
KeyBufferSize = IkeSaSession->NiBlkSize + IkeSaSession->NrBlkSize;
KeyBuffer = AllocateZeroPool (KeyBufferSize);
if (KeyBuffer == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (KeyBuffer, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);
CopyMem (KeyBuffer + IkeSaSession->NiBlkSize, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);
Fragments[0].Data = IkeSaSession->IkeKeys->DhBuffer->GxyBuffer;
Fragments[0].DataSize = IkeSaSession->IkeKeys->DhBuffer->GxySize;
DigestSize = IpSecGetHmacDigestLength ((UINT8)SaParams->Prf);
Digest = AllocateZeroPool (DigestSize);
if (Digest == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IpSecCryptoIoHmac (
(UINT8)SaParams->Prf,
KeyBuffer,
KeyBufferSize,
(HASH_DATA_FRAGMENT *) Fragments,
1,
Digest,
DigestSize
);
//
// {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr } = prf+
// (SKEYSEED, Ni | Nr | SPIi | SPIr )
//
Fragments[0].Data = IkeSaSession->NiBlock;
Fragments[0].DataSize = IkeSaSession->NiBlkSize;
Fragments[1].Data = IkeSaSession->NrBlock;
Fragments[1].DataSize = IkeSaSession->NrBlkSize;
InitiatorCookieNet = HTONLL (IkeSaSession->InitiatorCookie);
ResponderCookieNet = HTONLL (IkeSaSession->ResponderCookie);
Fragments[2].Data = (UINT8 *)(&InitiatorCookieNet);
Fragments[2].DataSize = sizeof (IkeSaSession->InitiatorCookie);
Fragments[3].Data = (UINT8 *)(&ResponderCookieNet);
Fragments[3].DataSize = sizeof (IkeSaSession->ResponderCookie);
IPSEC_DUMP_BUF (">>> NiBlock", IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);
IPSEC_DUMP_BUF (">>> NrBlock", IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);
IPSEC_DUMP_BUF (">>> InitiatorCookie", (UINT8 *)&IkeSaSession->InitiatorCookie, sizeof(UINT64));
IPSEC_DUMP_BUF (">>> ResponderCookie", (UINT8 *)&IkeSaSession->ResponderCookie, sizeof(UINT64));
OutputKeyLength = PrfAlgKeyLen +
2 * EncryptAlgKeyLen +
2 * AuthAlgKeyLen +
2 * IntegrityAlgKeyLen;
OutputKey = AllocateZeroPool (OutputKeyLength);
if (OutputKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
//
// Generate Seven Keymates.
//
Status = Ikev2SaGenerateKey (
(UINT8)SaParams->Prf,
Digest,
DigestSize,
OutputKey,
OutputKeyLength,
Fragments,
4
);
if (EFI_ERROR(Status)) {
goto Exit;
}
//
// Save the seven keys into KeySession.
// First, SK_d
//
IkeSaSession->IkeKeys->SkdKey = AllocateZeroPool (PrfAlgKeyLen);
if (IkeSaSession->IkeKeys->SkdKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkdKeySize = PrfAlgKeyLen;
CopyMem (IkeSaSession->IkeKeys->SkdKey, OutputKey, PrfAlgKeyLen);
IPSEC_DUMP_BUF (">>> SK_D Key", IkeSaSession->IkeKeys->SkdKey, PrfAlgKeyLen);
//
// Second, Sk_ai
//
IkeSaSession->IkeKeys->SkAiKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (IkeSaSession->IkeKeys->SkAiKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkAiKeySize = IntegrityAlgKeyLen;
CopyMem (IkeSaSession->IkeKeys->SkAiKey, OutputKey + PrfAlgKeyLen, IntegrityAlgKeyLen);
IPSEC_DUMP_BUF (">>> SK_Ai Key", IkeSaSession->IkeKeys->SkAiKey, IkeSaSession->IkeKeys->SkAiKeySize);
//
// Third, Sk_ar
//
IkeSaSession->IkeKeys->SkArKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (IkeSaSession->IkeKeys->SkArKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkArKeySize = IntegrityAlgKeyLen;
CopyMem (
IkeSaSession->IkeKeys->SkArKey,
OutputKey + PrfAlgKeyLen + IntegrityAlgKeyLen,
IntegrityAlgKeyLen
);
IPSEC_DUMP_BUF (">>> SK_Ar Key", IkeSaSession->IkeKeys->SkArKey, IkeSaSession->IkeKeys->SkArKeySize);
//
// Fourth, Sk_ei
//
IkeSaSession->IkeKeys->SkEiKey = AllocateZeroPool (EncryptAlgKeyLen);
if (IkeSaSession->IkeKeys->SkEiKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkEiKeySize = EncryptAlgKeyLen;
CopyMem (
IkeSaSession->IkeKeys->SkEiKey,
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen,
EncryptAlgKeyLen
);
IPSEC_DUMP_BUF (
">>> SK_Ei Key",
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen,
EncryptAlgKeyLen
);
//
// Fifth, Sk_er
//
IkeSaSession->IkeKeys->SkErKey = AllocateZeroPool (EncryptAlgKeyLen);
if (IkeSaSession->IkeKeys->SkErKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkErKeySize = EncryptAlgKeyLen;
CopyMem (
IkeSaSession->IkeKeys->SkErKey,
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + EncryptAlgKeyLen,
EncryptAlgKeyLen
);
IPSEC_DUMP_BUF (
">>> SK_Er Key",
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + EncryptAlgKeyLen,
EncryptAlgKeyLen
);
//
// Sixth, Sk_pi
//
IkeSaSession->IkeKeys->SkPiKey = AllocateZeroPool (AuthAlgKeyLen);
if (IkeSaSession->IkeKeys->SkPiKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkPiKeySize = AuthAlgKeyLen;
CopyMem (
IkeSaSession->IkeKeys->SkPiKey,
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + 2 * EncryptAlgKeyLen,
AuthAlgKeyLen
);
IPSEC_DUMP_BUF (
">>> SK_Pi Key",
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + 2 * EncryptAlgKeyLen,
AuthAlgKeyLen
);
//
// Seventh, Sk_pr
//
IkeSaSession->IkeKeys->SkPrKey = AllocateZeroPool (AuthAlgKeyLen);
if (IkeSaSession->IkeKeys->SkPrKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
IkeSaSession->IkeKeys->SkPrKeySize = AuthAlgKeyLen;
CopyMem (
IkeSaSession->IkeKeys->SkPrKey,
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + 2 * EncryptAlgKeyLen + AuthAlgKeyLen,
AuthAlgKeyLen
);
IPSEC_DUMP_BUF (
">>> SK_Pr Key",
OutputKey + AuthAlgKeyLen + 2 * IntegrityAlgKeyLen + 2 * EncryptAlgKeyLen + AuthAlgKeyLen,
AuthAlgKeyLen
);
Exit:
if (Digest != NULL) {
FreePool (Digest);
}
if (KeyBuffer != NULL) {
FreePool (KeyBuffer);
}
if (OutputKey != NULL) {
FreePool (OutputKey);
}
if (EFI_ERROR(Status)) {
if (IkeSaSession->IkeKeys->SkdKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkdKey);
}
if (IkeSaSession->IkeKeys->SkAiKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkAiKey);
}
if (IkeSaSession->IkeKeys->SkArKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkArKey);
}
if (IkeSaSession->IkeKeys->SkEiKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkEiKey);
}
if (IkeSaSession->IkeKeys->SkErKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkErKey);
}
if (IkeSaSession->IkeKeys->SkPiKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkPiKey);
}
if (IkeSaSession->IkeKeys->SkPrKey != NULL) {
FreePool (IkeSaSession->IkeKeys->SkPrKey);
}
}
return Status;
}
/**
Generates the Keys for the furthure IPsec Protocol.
@param[in] ChildSaSession Pointer to IKE Child SA Session.
@param[in] KePayload Pointer to Key payload used to generate the Key.
@retval EFI_UNSUPPORTED If one or more Algorithm Id is not supported.
@retval EFI_SUCCESS The operation succeeded.
**/
EFI_STATUS
Ikev2GenerateChildSaKeys (
IN IKEV2_CHILD_SA_SESSION *ChildSaSession,
IN IKE_PAYLOAD *KePayload
)
{
EFI_STATUS Status;
IKEV2_SA_PARAMS *SaParams;
PRF_DATA_FRAGMENT Fragments[3];
UINTN EncryptAlgKeyLen;
UINTN IntegrityAlgKeyLen;
UINT8* OutputKey;
UINTN OutputKeyLength;
Status = EFI_SUCCESS;
OutputKey = NULL;
if (KePayload != NULL) {
//
// Generate Gxy
//
Status = Ikev2GenerateSaDhComputeKey (ChildSaSession->DhBuffer, KePayload);
if (EFI_ERROR (Status)) {
goto Exit;
}
Fragments[0].Data = ChildSaSession->DhBuffer->GxyBuffer;
Fragments[0].DataSize = ChildSaSession->DhBuffer->GxySize;
}
Fragments[1].Data = ChildSaSession->NiBlock;
Fragments[1].DataSize = ChildSaSession->NiBlkSize;
Fragments[2].Data = ChildSaSession->NrBlock;
Fragments[2].DataSize = ChildSaSession->NrBlkSize;
//
// Get the key length of Authenticaion, Encryption, PRF, and Integrity.
//
SaParams = ChildSaSession->SessionCommon.SaParams;
EncryptAlgKeyLen = IpSecGetEncryptKeyLength ((UINT8)SaParams->EncAlgId);
IntegrityAlgKeyLen = IpSecGetHmacDigestLength ((UINT8)SaParams->IntegAlgId);
OutputKeyLength = 2 * EncryptAlgKeyLen + 2 * IntegrityAlgKeyLen;
if ((EncryptAlgKeyLen == 0) || (IntegrityAlgKeyLen == 0)) {
Status = EFI_UNSUPPORTED;
goto Exit;
}
//
//
// If KePayload is not NULL, calculate KEYMAT = prf+(SK_d, g^ir (new) | Ni | Nr ),
// otherwise, KEYMAT = prf+(SK_d, Ni | Nr )
//
OutputKey = AllocateZeroPool (OutputKeyLength);
if (OutputKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
//
// Derive Key from the SkdKey Buffer.
//
Status = Ikev2SaGenerateKey (
(UINT8)ChildSaSession->IkeSaSession->SessionCommon.SaParams->Prf,
ChildSaSession->IkeSaSession->IkeKeys->SkdKey,
ChildSaSession->IkeSaSession->IkeKeys->SkdKeySize,
OutputKey,
OutputKeyLength,
KePayload == NULL ? &Fragments[1] : Fragments,
KePayload == NULL ? 2 : 3
);
if (EFI_ERROR (Status)) {
goto Exit;
}
//
// Copy KEYMATE (SK_ENCRYPT_i | SK_ENCRYPT_r | SK_INTEG_i | SK_INTEG_r) to
// ChildKeyMates.
//
if (!ChildSaSession->SessionCommon.IsInitiator) {
//
// Initiator Encryption Key
//
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncAlgoId = (UINT8)SaParams->EncAlgId;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKeyLength = EncryptAlgKeyLen;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey = AllocateZeroPool (EncryptAlgKeyLen);
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey,
OutputKey,
EncryptAlgKeyLen
);
//
// Initiator Authentication Key
//
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthAlgoId = (UINT8)SaParams->IntegAlgId;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKeyLength = IntegrityAlgKeyLen;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey,
OutputKey + EncryptAlgKeyLen,
IntegrityAlgKeyLen
);
//
// Responder Encrypt Key
//
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncAlgoId = (UINT8)SaParams->EncAlgId;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKeyLength = EncryptAlgKeyLen;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey = AllocateZeroPool (EncryptAlgKeyLen);
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey,
OutputKey + EncryptAlgKeyLen + IntegrityAlgKeyLen,
EncryptAlgKeyLen
);
//
// Responder Authentication Key
//
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthAlgoId = (UINT8)SaParams->IntegAlgId;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKeyLength = IntegrityAlgKeyLen;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey,
OutputKey + 2 * EncryptAlgKeyLen + IntegrityAlgKeyLen,
IntegrityAlgKeyLen
);
} else {
//
// Initiator Encryption Key
//
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncAlgoId = (UINT8)SaParams->EncAlgId;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKeyLength = EncryptAlgKeyLen;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey = AllocateZeroPool (EncryptAlgKeyLen);
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey,
OutputKey,
EncryptAlgKeyLen
);
//
// Initiator Authentication Key
//
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthAlgoId = (UINT8)SaParams->IntegAlgId;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKeyLength = IntegrityAlgKeyLen;
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey,
OutputKey + EncryptAlgKeyLen,
IntegrityAlgKeyLen
);
//
// Responder Encryption Key
//
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncAlgoId = (UINT8)SaParams->EncAlgId;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKeyLength = EncryptAlgKeyLen;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey = AllocateZeroPool (EncryptAlgKeyLen);
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey,
OutputKey + EncryptAlgKeyLen + IntegrityAlgKeyLen,
EncryptAlgKeyLen
);
//
// Responder Authentication Key
//
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthAlgoId = (UINT8)SaParams->IntegAlgId;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKeyLength = IntegrityAlgKeyLen;
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey = AllocateZeroPool (IntegrityAlgKeyLen);
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey == NULL) {
Status = EFI_OUT_OF_RESOURCES;
goto Exit;
}
CopyMem (
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey,
OutputKey + 2 * EncryptAlgKeyLen + IntegrityAlgKeyLen,
IntegrityAlgKeyLen
);
}
IPSEC_DUMP_BUF (
" >>> Local Encryption Key",
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey,
EncryptAlgKeyLen
);
IPSEC_DUMP_BUF (
" >>> Remote Encryption Key",
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey,
EncryptAlgKeyLen
);
IPSEC_DUMP_BUF (
" >>> Local Authentication Key",
ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey,
IntegrityAlgKeyLen
);
IPSEC_DUMP_BUF (
" >>> Remote Authentication Key",
ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey,
IntegrityAlgKeyLen
);
Exit:
if (EFI_ERROR (Status)) {
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey != NULL) {
FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey);
}
if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey != NULL) {
FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey);
}
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey != NULL) {
FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey);
}
if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey != NULL) {
FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey);
}
}
if (OutputKey != NULL) {
FreePool (OutputKey);
}
return EFI_SUCCESS;
}
GLOBAL_REMOVE_IF_UNREFERENCED IKEV2_PACKET_HANDLER mIkev2Initial[][2] = {
{ //PSK
{ // IKEV2_INIT
Ikev2InitPskParser,
Ikev2InitPskGenerator
},
{ //IKEV2_AUTH
Ikev2AuthPskParser,
Ikev2AuthPskGenerator
}
},
{ // CERT
{ // IKEV2_INIT
Ikev2InitCertParser,
Ikev2InitCertGenerator
},
{ // IKEV2_AUTH
Ikev2AuthCertParser,
Ikev2AuthCertGenerator
},
},
};